EUVD-2026-41543
GHSA-692v-4vh8-pf96
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Log file read is a pure confidentiality flaw; I:N and A:N better reflect no integrity or availability impact than the vendor's I:L/A:L.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
AnalysisAI
Sensitive information disclosure in Dell PowerProtect Data Domain exposes credentials or configuration data to local low-privileged attackers via insufficiently protected log files. Affected are multiple release trains spanning versions 7.7.1.0 through 8.7, with specific LTS branches also impacted. No public exploit code or active exploitation has been identified at time of analysis, but the high confidentiality impact (C:H) warrants prompt patching on any appliance accessible to untrusted local users or shared administrative accounts.
Technical ContextAI
CWE-532 (Insertion of Sensitive Information into Log File) occurs when an application writes security-relevant data - such as passwords, tokens, session identifiers, or decryption keys - into log files that are readable by parties beyond those who should have access. Dell PowerProtect Data Domain is an enterprise backup and deduplication appliance running its own OS and management stack. The CVSS vector (AV:L/AC:H) indicates the flaw is exercised locally and requires a high-complexity triggering condition, suggesting sensitive material is logged only under specific operational states (e.g., during certain backup jobs, configuration changes, or error conditions) rather than unconditionally. The affected CPE covers the mainline 7.7.x-8.7 codebase and three LTS branches (LTS2024, LTS2025, LTS2026), indicating the defect spans multiple code generations.
RemediationAI
Apply the security update documented in Dell advisory DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities). The advisory covers multiple vulnerabilities simultaneously; the exact remediated version numbers per release train must be obtained directly from that advisory, as specific fix versions were not independently confirmed in the available intelligence data. As a compensating control pending patching, restrict local OS-level access to the Data Domain appliance to only necessary privileged administrators and audit existing local accounts for necessity. Additionally, review and restrict access permissions on Data Domain log directories and files, and integrate log forwarding to a SIEM with access controls ensuring only security operations personnel can read raw log content - this limits the blast radius if a low-privileged account reads the logs, without requiring log rotation or purging that could affect operational visibility.
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LT
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS20
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path t
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary oper
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today